Aguara CLI
A local scanner flagging malicious packages and risky permissions in dependencies, agent instructions and MCP configs.
- 94 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Reads project files and MCP client configurations on the machine, and reports can contain sensitive fragments.
Install
- Works in
Manual install
curl -fsSL https://raw.githubusercontent.com/garagon/aguara/v0.28.0/install.sh | VERSION=v0.28.0 shThe installer verifies the archive checksum; the binary lands in `~/.local/bin`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads project files and MCP client configurations on the machine, and reports can contain sensitive fragments.
This is third-party code. Review the repository files before installing.
What it does
Aguara checks what a project brings into your environment: dependencies, agent instructions and tool settings. `aguara audit .` combines a known-malicious-package check over lockfiles with a content scan. It does not install packages or run the project's commands. The scan covers skills and instructions for prompt injection and suspicious secret requests, MCP configurations, Claude Code settings in `.claude/settings.json`, npm and pnpm policy, install hooks and GitHub Actions risks. Analysis runs locally with no telemetry or LLM calls. Output formats are terminal, JSON, SARIF and Markdown.
Who it is for. Developers and security engineers who want to see risks in dependencies and agent settings before installing someone else's repository or skill.
Good fit when
- Lockfiles of an unfamiliar repository should be checked before `npm install`.
- Someone else's skill or `AGENTS.md` suspiciously asks to read secrets.
- `.claude/settings.json` contains `Bash(*)`, and the need for that access must be judged.
- CI needs an `aguara audit . --ci` gate ahead of dependency installation.
Not a fit when
- Full CVE analysis is needed; the tool finds malicious packages rather than vulnerabilities in general.
- Runtime protection is needed; Aguara does not sandbox processes or intercept calls.
- A clean report would be treated as a safety certificate.
Example request
Audit this repository with `aguara audit .` and explain the highest-severity findings.Limitations
A clean report does not guarantee safety: unsupported formats, dynamic code and new threats can be missed. Version 0.28.0 ignores exclusions and suppressions from the audited repository by default, while local `scan` honours them, so unfamiliar projects need `--project-policy ignore`. Binary `bun.lockb` is not parsed; the text `bun.lock` is required. Coverage of package ecosystems depends on what the lockfile records and what the threat data snapshot knows.
How to disable. Delete the `aguara` binary from `~/.local/bin` (or run `brew uninstall aguara`) and drop the `aguara audit . --ci` step from the CI configuration.
FAQ
How do I check a repository or skill before installing it?
Run `aguara audit .` in the project directory. It matches lockfiles against known-malicious package data and scans content without installing anything.
How do I check MCP configurations on my machine?
Run `aguara scan --auto`: the scanner discovers supported MCP client configurations. `aguara discover` lists them.
How do I add Aguara to CI?
Add `aguara audit . --ci` before dependencies are installed. The step fails on critical findings, and `--baseline` records known ones.
Does Aguara send data anywhere?
No. The README states local analysis with no package execution, content upload, telemetry or LLM calls.
Which package managers are supported?
npm, PyPI, Go, Rust, PHP, Ruby, Java and .NET. Lockfiles are read without installing dependencies.
Discussion
No questions or reviews yet.
Related
CLI toolsA scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A security scanner CLI for code and AI agents: vets .claude, hooks, MCP configs and SKILL.md before cloning and finds leaked keys
A security scanner for MCP servers and agent skills that looks for prompt injection, secret leaks and swaps after approval.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Aguara (this card) | no | 94 | |
| Skill Scanner | no | 2,724 | inspects skills; Aguara also matches dependencies against malicious-package data and reviews agent settings and CI |
| MCP Scanner | yes | 1,117 | scans MCP servers; Aguara also covers skills, dependencies and Claude Code configuration |
README in short
A quick start, a table of checks by object type, supported package managers, threat data sources (OSV and OpenSSF Malicious Packages), CI adoption with a baseline and signed releases are described. A dedicated section lists limitations.